diff --git a/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go.tmpl b/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go.tmpl index dc108466..791e47a6 100644 --- a/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go.tmpl +++ b/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go.tmpl @@ -46,7 +46,7 @@ type ActiveDirectoryIdentityProviderBind struct { } type ActiveDirectoryIdentityProviderUserSearchAttributes struct { - // Username specifies the name of the attribute in the ActiveDirectory entry whose value shall become the username + // Username specifies the name of the attribute in Active Directory entry whose value shall become the username // of the user after a successful authentication. This would typically be the same attribute name used in // Optional, when empty this defaults to "sAMAccountName". // +optional @@ -64,7 +64,7 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { // in the user's list of groups after a successful authentication. // The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory // server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". - // Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). + // Optional. When not specified, this defaults to "sAMAccountName". // +optional GroupName string `json:"groupName,omitempty"` } @@ -72,20 +72,17 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { type ActiveDirectoryIdentityProviderUserSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for users. // E.g. "ou=users,dc=example,dc=com". - // Optional, when not specified it will search the whole directory tree. - // Note that if your bind user only has permission to search a subtree, this must be specified. - // Search a subtree will also be faster. + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` - // Filter is the ActiveDirectory search filter which should be applied when searching for users. The pattern "{}" must occur + // Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur // in the filter at least once and will be dynamically replaced by the username for which the search is being run. - // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about ActiveDirectory filters, see + // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as the value from - // Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be - // explicitly specified, since the default value of "dn={}" would not work. + // Optional. When not specified, the default will be + // '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' // +optional Filter string `json:"filter,omitempty"` @@ -97,9 +94,8 @@ type ActiveDirectoryIdentityProviderUserSearch struct { type ActiveDirectoryIdentityProviderGroupSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. - // "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and - // authenticated users will not belong to any groups from the ActiveDirectory provider. Also, when not specified, - // the values of Filter and Attributes are ignored. + // "ou=groups,dc=example,dc=com". + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` @@ -109,7 +105,9 @@ type ActiveDirectoryIdentityProviderGroupSearch struct { // "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as "member={}". + // Optional. When not specified, the default will act as if the Filter were specified as + // "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + // This searches nested groups by default. // +optional Filter string `json:"filter,omitempty"` diff --git a/deploy/supervisor/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml b/deploy/supervisor/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml index 0f94c50a..48659053 100644 --- a/deploy/supervisor/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml +++ b/deploy/supervisor/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml @@ -88,18 +88,15 @@ spec: and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying - lower-case "dn". Optional. When not specified, the default - will act as if the GroupName were specified as "dn" (distinguished - name). + lower-case "dn". Optional. When not specified, this defaults + to "sAMAccountName". type: string type: object base: description: Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". - When not specified, no group search will be performed and authenticated - users will not belong to any groups from the ActiveDirectory - provider. Also, when not specified, the values of Filter and - Attributes are ignored. + Optional, when not specified it will be based on the result + of a query for the default naming context. type: string filter: description: Filter is the ActiveDirectory search filter which @@ -111,7 +108,8 @@ spec: about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, - the default will act as if the Filter were specified as "member={}". + the default will act as if the Filter were specified as "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + This searches nested groups by default. type: string type: object host: @@ -146,33 +144,28 @@ spec: type: string username: description: Username specifies the name of the attribute - in the ActiveDirectory entry whose value shall become the - username of the user after a successful authentication. - This would typically be the same attribute name used in - Optional, when empty this defaults to "sAMAccountName". + in Active Directory entry whose value shall become the username + of the user after a successful authentication. This would + typically be the same attribute name used in Optional, when + empty this defaults to "sAMAccountName". type: string type: object base: description: Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". - Optional, when not specified it will search the whole directory - tree. Note that if your bind user only has permission to search - a subtree, this must be specified. Search a subtree will also - be faster. + Optional, when not specified it will be based on the result + of a query for the default naming context. type: string filter: - description: Filter is the ActiveDirectory search filter which - should be applied when searching for users. The pattern "{}" - must occur in the filter at least once and will be dynamically - replaced by the username for which the search is being run. - E.g. "mail={}" or "&(objectClass=person)(uid={})". For more - information about ActiveDirectory filters, see https://ldap.com/ldap-filters. - Note that the dn (distinguished name) is not an attribute of - an entry, so "dn={}" cannot be used. Optional. When not specified, - the default will act as if the Filter were specified as the - value from Attributes.Username appended by "={}". When the Attributes.Username - is set to "dn" then the Filter must be explicitly specified, - since the default value of "dn={}" would not work. + description: Filter is the search filter which should be applied + when searching for users. The pattern "{}" must occur in the + filter at least once and will be dynamically replaced by the + username for which the search is being run. E.g. "mail={}" or + "&(objectClass=person)(uid={})". For more information about + LDAP filters, see https://ldap.com/ldap-filters. Note that the + dn (distinguished name) is not an attribute of an entry, so + "dn={}" cannot be used. Optional. When not specified, the default + will be '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' type: string type: object required: diff --git a/generated/1.17/README.adoc b/generated/1.17/README.adoc index 288c802d..9cce1476 100644 --- a/generated/1.17/README.adoc +++ b/generated/1.17/README.adoc @@ -798,8 +798,8 @@ ActiveDirectoryIdentityProvider describes the configuration of an upstream Micro [cols="25a,75a", options="header"] |=== | Field | Description -| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and authenticated users will not belong to any groups from the ActiveDirectory provider. Also, when not specified, the values of Filter and Attributes are ignored. -| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for groups for a user. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the dn (distinguished name) of the user entry found as a result of the user search. E.g. "member={}" or "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as "member={}". +| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". Optional, when not specified it will be based on the result of a query for the default naming context. +| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for groups for a user. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the dn (distinguished name) of the user entry found as a result of the user search. E.g. "member={}" or "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". This searches nested groups by default. | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovidergroupsearchattributes[$$ActiveDirectoryIdentityProviderGroupSearchAttributes$$]__ | Attributes specifies how the group's information should be read from each ActiveDirectory entry which was found as the result of the group search. |=== @@ -817,7 +817,7 @@ ActiveDirectoryIdentityProvider describes the configuration of an upstream Micro [cols="25a,75a", options="header"] |=== | Field | Description -| *`groupName`* __string__ | GroupName specifies the name of the attribute in the Active Directory entries whose value shall become a group name in the user's list of groups after a successful authentication. The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). +| *`groupName`* __string__ | GroupName specifies the name of the attribute in the Active Directory entries whose value shall become a group name in the user's list of groups after a successful authentication. The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". Optional. When not specified, this defaults to "sAMAccountName". |=== @@ -875,8 +875,8 @@ Status of an Active Directory identity provider. [cols="25a,75a", options="header"] |=== | Field | Description -| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". Optional, when not specified it will search the whole directory tree. Note that if your bind user only has permission to search a subtree, this must be specified. Search a subtree will also be faster. -| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for users. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be explicitly specified, since the default value of "dn={}" would not work. +| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". Optional, when not specified it will be based on the result of a query for the default naming context. +| *`filter`* __string__ | Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will be '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderusersearchattributes[$$ActiveDirectoryIdentityProviderUserSearchAttributes$$]__ | Attributes specifies how the user's information should be read from the ActiveDirectory entry which was found as the result of the user search. |=== @@ -894,7 +894,7 @@ Status of an Active Directory identity provider. [cols="25a,75a", options="header"] |=== | Field | Description -| *`username`* __string__ | Username specifies the name of the attribute in the ActiveDirectory entry whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in Optional, when empty this defaults to "sAMAccountName". +| *`username`* __string__ | Username specifies the name of the attribute in Active Directory entry whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in Optional, when empty this defaults to "sAMAccountName". | *`uid`* __string__ | UID specifies the name of the attribute in the ActiveDirectory entry which whose value shall be used to uniquely identify the user within this ActiveDirectory provider after a successful authentication. Optional, when empty this defaults to "objectGUID". |=== diff --git a/generated/1.17/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go b/generated/1.17/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go index dc108466..791e47a6 100644 --- a/generated/1.17/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go +++ b/generated/1.17/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go @@ -46,7 +46,7 @@ type ActiveDirectoryIdentityProviderBind struct { } type ActiveDirectoryIdentityProviderUserSearchAttributes struct { - // Username specifies the name of the attribute in the ActiveDirectory entry whose value shall become the username + // Username specifies the name of the attribute in Active Directory entry whose value shall become the username // of the user after a successful authentication. This would typically be the same attribute name used in // Optional, when empty this defaults to "sAMAccountName". // +optional @@ -64,7 +64,7 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { // in the user's list of groups after a successful authentication. // The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory // server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". - // Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). + // Optional. When not specified, this defaults to "sAMAccountName". // +optional GroupName string `json:"groupName,omitempty"` } @@ -72,20 +72,17 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { type ActiveDirectoryIdentityProviderUserSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for users. // E.g. "ou=users,dc=example,dc=com". - // Optional, when not specified it will search the whole directory tree. - // Note that if your bind user only has permission to search a subtree, this must be specified. - // Search a subtree will also be faster. + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` - // Filter is the ActiveDirectory search filter which should be applied when searching for users. The pattern "{}" must occur + // Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur // in the filter at least once and will be dynamically replaced by the username for which the search is being run. - // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about ActiveDirectory filters, see + // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as the value from - // Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be - // explicitly specified, since the default value of "dn={}" would not work. + // Optional. When not specified, the default will be + // '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' // +optional Filter string `json:"filter,omitempty"` @@ -97,9 +94,8 @@ type ActiveDirectoryIdentityProviderUserSearch struct { type ActiveDirectoryIdentityProviderGroupSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. - // "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and - // authenticated users will not belong to any groups from the ActiveDirectory provider. Also, when not specified, - // the values of Filter and Attributes are ignored. + // "ou=groups,dc=example,dc=com". + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` @@ -109,7 +105,9 @@ type ActiveDirectoryIdentityProviderGroupSearch struct { // "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as "member={}". + // Optional. When not specified, the default will act as if the Filter were specified as + // "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + // This searches nested groups by default. // +optional Filter string `json:"filter,omitempty"` diff --git a/generated/1.17/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml b/generated/1.17/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml index 0f94c50a..48659053 100644 --- a/generated/1.17/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml +++ b/generated/1.17/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml @@ -88,18 +88,15 @@ spec: and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying - lower-case "dn". Optional. When not specified, the default - will act as if the GroupName were specified as "dn" (distinguished - name). + lower-case "dn". Optional. When not specified, this defaults + to "sAMAccountName". type: string type: object base: description: Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". - When not specified, no group search will be performed and authenticated - users will not belong to any groups from the ActiveDirectory - provider. Also, when not specified, the values of Filter and - Attributes are ignored. + Optional, when not specified it will be based on the result + of a query for the default naming context. type: string filter: description: Filter is the ActiveDirectory search filter which @@ -111,7 +108,8 @@ spec: about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, - the default will act as if the Filter were specified as "member={}". + the default will act as if the Filter were specified as "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + This searches nested groups by default. type: string type: object host: @@ -146,33 +144,28 @@ spec: type: string username: description: Username specifies the name of the attribute - in the ActiveDirectory entry whose value shall become the - username of the user after a successful authentication. - This would typically be the same attribute name used in - Optional, when empty this defaults to "sAMAccountName". + in Active Directory entry whose value shall become the username + of the user after a successful authentication. This would + typically be the same attribute name used in Optional, when + empty this defaults to "sAMAccountName". type: string type: object base: description: Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". - Optional, when not specified it will search the whole directory - tree. Note that if your bind user only has permission to search - a subtree, this must be specified. Search a subtree will also - be faster. + Optional, when not specified it will be based on the result + of a query for the default naming context. type: string filter: - description: Filter is the ActiveDirectory search filter which - should be applied when searching for users. The pattern "{}" - must occur in the filter at least once and will be dynamically - replaced by the username for which the search is being run. - E.g. "mail={}" or "&(objectClass=person)(uid={})". For more - information about ActiveDirectory filters, see https://ldap.com/ldap-filters. - Note that the dn (distinguished name) is not an attribute of - an entry, so "dn={}" cannot be used. Optional. When not specified, - the default will act as if the Filter were specified as the - value from Attributes.Username appended by "={}". When the Attributes.Username - is set to "dn" then the Filter must be explicitly specified, - since the default value of "dn={}" would not work. + description: Filter is the search filter which should be applied + when searching for users. The pattern "{}" must occur in the + filter at least once and will be dynamically replaced by the + username for which the search is being run. E.g. "mail={}" or + "&(objectClass=person)(uid={})". For more information about + LDAP filters, see https://ldap.com/ldap-filters. Note that the + dn (distinguished name) is not an attribute of an entry, so + "dn={}" cannot be used. Optional. When not specified, the default + will be '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' type: string type: object required: diff --git a/generated/1.18/README.adoc b/generated/1.18/README.adoc index 8d99ecc4..ed0623c6 100644 --- a/generated/1.18/README.adoc +++ b/generated/1.18/README.adoc @@ -798,8 +798,8 @@ ActiveDirectoryIdentityProvider describes the configuration of an upstream Micro [cols="25a,75a", options="header"] |=== | Field | Description -| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and authenticated users will not belong to any groups from the ActiveDirectory provider. Also, when not specified, the values of Filter and Attributes are ignored. -| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for groups for a user. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the dn (distinguished name) of the user entry found as a result of the user search. E.g. "member={}" or "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as "member={}". +| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". Optional, when not specified it will be based on the result of a query for the default naming context. +| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for groups for a user. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the dn (distinguished name) of the user entry found as a result of the user search. E.g. "member={}" or "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". This searches nested groups by default. | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovidergroupsearchattributes[$$ActiveDirectoryIdentityProviderGroupSearchAttributes$$]__ | Attributes specifies how the group's information should be read from each ActiveDirectory entry which was found as the result of the group search. |=== @@ -817,7 +817,7 @@ ActiveDirectoryIdentityProvider describes the configuration of an upstream Micro [cols="25a,75a", options="header"] |=== | Field | Description -| *`groupName`* __string__ | GroupName specifies the name of the attribute in the Active Directory entries whose value shall become a group name in the user's list of groups after a successful authentication. The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). +| *`groupName`* __string__ | GroupName specifies the name of the attribute in the Active Directory entries whose value shall become a group name in the user's list of groups after a successful authentication. The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". Optional. When not specified, this defaults to "sAMAccountName". |=== @@ -875,8 +875,8 @@ Status of an Active Directory identity provider. [cols="25a,75a", options="header"] |=== | Field | Description -| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". Optional, when not specified it will search the whole directory tree. Note that if your bind user only has permission to search a subtree, this must be specified. Search a subtree will also be faster. -| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for users. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be explicitly specified, since the default value of "dn={}" would not work. +| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". Optional, when not specified it will be based on the result of a query for the default naming context. +| *`filter`* __string__ | Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will be '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderusersearchattributes[$$ActiveDirectoryIdentityProviderUserSearchAttributes$$]__ | Attributes specifies how the user's information should be read from the ActiveDirectory entry which was found as the result of the user search. |=== @@ -894,7 +894,7 @@ Status of an Active Directory identity provider. [cols="25a,75a", options="header"] |=== | Field | Description -| *`username`* __string__ | Username specifies the name of the attribute in the ActiveDirectory entry whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in Optional, when empty this defaults to "sAMAccountName". +| *`username`* __string__ | Username specifies the name of the attribute in Active Directory entry whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in Optional, when empty this defaults to "sAMAccountName". | *`uid`* __string__ | UID specifies the name of the attribute in the ActiveDirectory entry which whose value shall be used to uniquely identify the user within this ActiveDirectory provider after a successful authentication. Optional, when empty this defaults to "objectGUID". |=== diff --git a/generated/1.18/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go b/generated/1.18/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go index dc108466..791e47a6 100644 --- a/generated/1.18/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go +++ b/generated/1.18/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go @@ -46,7 +46,7 @@ type ActiveDirectoryIdentityProviderBind struct { } type ActiveDirectoryIdentityProviderUserSearchAttributes struct { - // Username specifies the name of the attribute in the ActiveDirectory entry whose value shall become the username + // Username specifies the name of the attribute in Active Directory entry whose value shall become the username // of the user after a successful authentication. This would typically be the same attribute name used in // Optional, when empty this defaults to "sAMAccountName". // +optional @@ -64,7 +64,7 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { // in the user's list of groups after a successful authentication. // The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory // server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". - // Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). + // Optional. When not specified, this defaults to "sAMAccountName". // +optional GroupName string `json:"groupName,omitempty"` } @@ -72,20 +72,17 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { type ActiveDirectoryIdentityProviderUserSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for users. // E.g. "ou=users,dc=example,dc=com". - // Optional, when not specified it will search the whole directory tree. - // Note that if your bind user only has permission to search a subtree, this must be specified. - // Search a subtree will also be faster. + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` - // Filter is the ActiveDirectory search filter which should be applied when searching for users. The pattern "{}" must occur + // Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur // in the filter at least once and will be dynamically replaced by the username for which the search is being run. - // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about ActiveDirectory filters, see + // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as the value from - // Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be - // explicitly specified, since the default value of "dn={}" would not work. + // Optional. When not specified, the default will be + // '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' // +optional Filter string `json:"filter,omitempty"` @@ -97,9 +94,8 @@ type ActiveDirectoryIdentityProviderUserSearch struct { type ActiveDirectoryIdentityProviderGroupSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. - // "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and - // authenticated users will not belong to any groups from the ActiveDirectory provider. Also, when not specified, - // the values of Filter and Attributes are ignored. + // "ou=groups,dc=example,dc=com". + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` @@ -109,7 +105,9 @@ type ActiveDirectoryIdentityProviderGroupSearch struct { // "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as "member={}". + // Optional. When not specified, the default will act as if the Filter were specified as + // "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + // This searches nested groups by default. // +optional Filter string `json:"filter,omitempty"` diff --git a/generated/1.18/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml b/generated/1.18/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml index 0f94c50a..48659053 100644 --- a/generated/1.18/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml +++ b/generated/1.18/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml @@ -88,18 +88,15 @@ spec: and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying - lower-case "dn". Optional. When not specified, the default - will act as if the GroupName were specified as "dn" (distinguished - name). + lower-case "dn". Optional. When not specified, this defaults + to "sAMAccountName". type: string type: object base: description: Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". - When not specified, no group search will be performed and authenticated - users will not belong to any groups from the ActiveDirectory - provider. Also, when not specified, the values of Filter and - Attributes are ignored. + Optional, when not specified it will be based on the result + of a query for the default naming context. type: string filter: description: Filter is the ActiveDirectory search filter which @@ -111,7 +108,8 @@ spec: about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, - the default will act as if the Filter were specified as "member={}". + the default will act as if the Filter were specified as "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + This searches nested groups by default. type: string type: object host: @@ -146,33 +144,28 @@ spec: type: string username: description: Username specifies the name of the attribute - in the ActiveDirectory entry whose value shall become the - username of the user after a successful authentication. - This would typically be the same attribute name used in - Optional, when empty this defaults to "sAMAccountName". + in Active Directory entry whose value shall become the username + of the user after a successful authentication. This would + typically be the same attribute name used in Optional, when + empty this defaults to "sAMAccountName". type: string type: object base: description: Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". - Optional, when not specified it will search the whole directory - tree. Note that if your bind user only has permission to search - a subtree, this must be specified. Search a subtree will also - be faster. + Optional, when not specified it will be based on the result + of a query for the default naming context. type: string filter: - description: Filter is the ActiveDirectory search filter which - should be applied when searching for users. The pattern "{}" - must occur in the filter at least once and will be dynamically - replaced by the username for which the search is being run. - E.g. "mail={}" or "&(objectClass=person)(uid={})". For more - information about ActiveDirectory filters, see https://ldap.com/ldap-filters. - Note that the dn (distinguished name) is not an attribute of - an entry, so "dn={}" cannot be used. Optional. When not specified, - the default will act as if the Filter were specified as the - value from Attributes.Username appended by "={}". When the Attributes.Username - is set to "dn" then the Filter must be explicitly specified, - since the default value of "dn={}" would not work. + description: Filter is the search filter which should be applied + when searching for users. The pattern "{}" must occur in the + filter at least once and will be dynamically replaced by the + username for which the search is being run. E.g. "mail={}" or + "&(objectClass=person)(uid={})". For more information about + LDAP filters, see https://ldap.com/ldap-filters. Note that the + dn (distinguished name) is not an attribute of an entry, so + "dn={}" cannot be used. Optional. When not specified, the default + will be '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' type: string type: object required: diff --git a/generated/1.19/README.adoc b/generated/1.19/README.adoc index e999bf69..45191ade 100644 --- a/generated/1.19/README.adoc +++ b/generated/1.19/README.adoc @@ -798,8 +798,8 @@ ActiveDirectoryIdentityProvider describes the configuration of an upstream Micro [cols="25a,75a", options="header"] |=== | Field | Description -| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and authenticated users will not belong to any groups from the ActiveDirectory provider. Also, when not specified, the values of Filter and Attributes are ignored. -| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for groups for a user. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the dn (distinguished name) of the user entry found as a result of the user search. E.g. "member={}" or "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as "member={}". +| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". Optional, when not specified it will be based on the result of a query for the default naming context. +| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for groups for a user. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the dn (distinguished name) of the user entry found as a result of the user search. E.g. "member={}" or "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". This searches nested groups by default. | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovidergroupsearchattributes[$$ActiveDirectoryIdentityProviderGroupSearchAttributes$$]__ | Attributes specifies how the group's information should be read from each ActiveDirectory entry which was found as the result of the group search. |=== @@ -817,7 +817,7 @@ ActiveDirectoryIdentityProvider describes the configuration of an upstream Micro [cols="25a,75a", options="header"] |=== | Field | Description -| *`groupName`* __string__ | GroupName specifies the name of the attribute in the Active Directory entries whose value shall become a group name in the user's list of groups after a successful authentication. The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). +| *`groupName`* __string__ | GroupName specifies the name of the attribute in the Active Directory entries whose value shall become a group name in the user's list of groups after a successful authentication. The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". Optional. When not specified, this defaults to "sAMAccountName". |=== @@ -875,8 +875,8 @@ Status of an Active Directory identity provider. [cols="25a,75a", options="header"] |=== | Field | Description -| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". Optional, when not specified it will search the whole directory tree. Note that if your bind user only has permission to search a subtree, this must be specified. Search a subtree will also be faster. -| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for users. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be explicitly specified, since the default value of "dn={}" would not work. +| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". Optional, when not specified it will be based on the result of a query for the default naming context. +| *`filter`* __string__ | Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will be '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderusersearchattributes[$$ActiveDirectoryIdentityProviderUserSearchAttributes$$]__ | Attributes specifies how the user's information should be read from the ActiveDirectory entry which was found as the result of the user search. |=== @@ -894,7 +894,7 @@ Status of an Active Directory identity provider. [cols="25a,75a", options="header"] |=== | Field | Description -| *`username`* __string__ | Username specifies the name of the attribute in the ActiveDirectory entry whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in Optional, when empty this defaults to "sAMAccountName". +| *`username`* __string__ | Username specifies the name of the attribute in Active Directory entry whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in Optional, when empty this defaults to "sAMAccountName". | *`uid`* __string__ | UID specifies the name of the attribute in the ActiveDirectory entry which whose value shall be used to uniquely identify the user within this ActiveDirectory provider after a successful authentication. Optional, when empty this defaults to "objectGUID". |=== diff --git a/generated/1.19/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go b/generated/1.19/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go index dc108466..791e47a6 100644 --- a/generated/1.19/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go +++ b/generated/1.19/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go @@ -46,7 +46,7 @@ type ActiveDirectoryIdentityProviderBind struct { } type ActiveDirectoryIdentityProviderUserSearchAttributes struct { - // Username specifies the name of the attribute in the ActiveDirectory entry whose value shall become the username + // Username specifies the name of the attribute in Active Directory entry whose value shall become the username // of the user after a successful authentication. This would typically be the same attribute name used in // Optional, when empty this defaults to "sAMAccountName". // +optional @@ -64,7 +64,7 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { // in the user's list of groups after a successful authentication. // The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory // server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". - // Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). + // Optional. When not specified, this defaults to "sAMAccountName". // +optional GroupName string `json:"groupName,omitempty"` } @@ -72,20 +72,17 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { type ActiveDirectoryIdentityProviderUserSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for users. // E.g. "ou=users,dc=example,dc=com". - // Optional, when not specified it will search the whole directory tree. - // Note that if your bind user only has permission to search a subtree, this must be specified. - // Search a subtree will also be faster. + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` - // Filter is the ActiveDirectory search filter which should be applied when searching for users. The pattern "{}" must occur + // Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur // in the filter at least once and will be dynamically replaced by the username for which the search is being run. - // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about ActiveDirectory filters, see + // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as the value from - // Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be - // explicitly specified, since the default value of "dn={}" would not work. + // Optional. When not specified, the default will be + // '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' // +optional Filter string `json:"filter,omitempty"` @@ -97,9 +94,8 @@ type ActiveDirectoryIdentityProviderUserSearch struct { type ActiveDirectoryIdentityProviderGroupSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. - // "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and - // authenticated users will not belong to any groups from the ActiveDirectory provider. Also, when not specified, - // the values of Filter and Attributes are ignored. + // "ou=groups,dc=example,dc=com". + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` @@ -109,7 +105,9 @@ type ActiveDirectoryIdentityProviderGroupSearch struct { // "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as "member={}". + // Optional. When not specified, the default will act as if the Filter were specified as + // "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + // This searches nested groups by default. // +optional Filter string `json:"filter,omitempty"` diff --git a/generated/1.19/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml b/generated/1.19/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml index 0f94c50a..48659053 100644 --- a/generated/1.19/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml +++ b/generated/1.19/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml @@ -88,18 +88,15 @@ spec: and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying - lower-case "dn". Optional. When not specified, the default - will act as if the GroupName were specified as "dn" (distinguished - name). + lower-case "dn". Optional. When not specified, this defaults + to "sAMAccountName". type: string type: object base: description: Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". - When not specified, no group search will be performed and authenticated - users will not belong to any groups from the ActiveDirectory - provider. Also, when not specified, the values of Filter and - Attributes are ignored. + Optional, when not specified it will be based on the result + of a query for the default naming context. type: string filter: description: Filter is the ActiveDirectory search filter which @@ -111,7 +108,8 @@ spec: about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, - the default will act as if the Filter were specified as "member={}". + the default will act as if the Filter were specified as "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + This searches nested groups by default. type: string type: object host: @@ -146,33 +144,28 @@ spec: type: string username: description: Username specifies the name of the attribute - in the ActiveDirectory entry whose value shall become the - username of the user after a successful authentication. - This would typically be the same attribute name used in - Optional, when empty this defaults to "sAMAccountName". + in Active Directory entry whose value shall become the username + of the user after a successful authentication. This would + typically be the same attribute name used in Optional, when + empty this defaults to "sAMAccountName". type: string type: object base: description: Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". - Optional, when not specified it will search the whole directory - tree. Note that if your bind user only has permission to search - a subtree, this must be specified. Search a subtree will also - be faster. + Optional, when not specified it will be based on the result + of a query for the default naming context. type: string filter: - description: Filter is the ActiveDirectory search filter which - should be applied when searching for users. The pattern "{}" - must occur in the filter at least once and will be dynamically - replaced by the username for which the search is being run. - E.g. "mail={}" or "&(objectClass=person)(uid={})". For more - information about ActiveDirectory filters, see https://ldap.com/ldap-filters. - Note that the dn (distinguished name) is not an attribute of - an entry, so "dn={}" cannot be used. Optional. When not specified, - the default will act as if the Filter were specified as the - value from Attributes.Username appended by "={}". When the Attributes.Username - is set to "dn" then the Filter must be explicitly specified, - since the default value of "dn={}" would not work. + description: Filter is the search filter which should be applied + when searching for users. The pattern "{}" must occur in the + filter at least once and will be dynamically replaced by the + username for which the search is being run. E.g. "mail={}" or + "&(objectClass=person)(uid={})". For more information about + LDAP filters, see https://ldap.com/ldap-filters. Note that the + dn (distinguished name) is not an attribute of an entry, so + "dn={}" cannot be used. Optional. When not specified, the default + will be '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' type: string type: object required: diff --git a/generated/1.20/README.adoc b/generated/1.20/README.adoc index 2eccb623..146d458b 100644 --- a/generated/1.20/README.adoc +++ b/generated/1.20/README.adoc @@ -798,8 +798,8 @@ ActiveDirectoryIdentityProvider describes the configuration of an upstream Micro [cols="25a,75a", options="header"] |=== | Field | Description -| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and authenticated users will not belong to any groups from the ActiveDirectory provider. Also, when not specified, the values of Filter and Attributes are ignored. -| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for groups for a user. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the dn (distinguished name) of the user entry found as a result of the user search. E.g. "member={}" or "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as "member={}". +| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". Optional, when not specified it will be based on the result of a query for the default naming context. +| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for groups for a user. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the dn (distinguished name) of the user entry found as a result of the user search. E.g. "member={}" or "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". This searches nested groups by default. | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovidergroupsearchattributes[$$ActiveDirectoryIdentityProviderGroupSearchAttributes$$]__ | Attributes specifies how the group's information should be read from each ActiveDirectory entry which was found as the result of the group search. |=== @@ -817,7 +817,7 @@ ActiveDirectoryIdentityProvider describes the configuration of an upstream Micro [cols="25a,75a", options="header"] |=== | Field | Description -| *`groupName`* __string__ | GroupName specifies the name of the attribute in the Active Directory entries whose value shall become a group name in the user's list of groups after a successful authentication. The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). +| *`groupName`* __string__ | GroupName specifies the name of the attribute in the Active Directory entries whose value shall become a group name in the user's list of groups after a successful authentication. The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". Optional. When not specified, this defaults to "sAMAccountName". |=== @@ -875,8 +875,8 @@ Status of an Active Directory identity provider. [cols="25a,75a", options="header"] |=== | Field | Description -| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". Optional, when not specified it will search the whole directory tree. Note that if your bind user only has permission to search a subtree, this must be specified. Search a subtree will also be faster. -| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for users. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will act as if the Filter were specified as the value from Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be explicitly specified, since the default value of "dn={}" would not work. +| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". Optional, when not specified it will be based on the result of a query for the default naming context. +| *`filter`* __string__ | Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the username for which the search is being run. E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, the default will be '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' | *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderusersearchattributes[$$ActiveDirectoryIdentityProviderUserSearchAttributes$$]__ | Attributes specifies how the user's information should be read from the ActiveDirectory entry which was found as the result of the user search. |=== @@ -894,7 +894,7 @@ Status of an Active Directory identity provider. [cols="25a,75a", options="header"] |=== | Field | Description -| *`username`* __string__ | Username specifies the name of the attribute in the ActiveDirectory entry whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in Optional, when empty this defaults to "sAMAccountName". +| *`username`* __string__ | Username specifies the name of the attribute in Active Directory entry whose value shall become the username of the user after a successful authentication. This would typically be the same attribute name used in Optional, when empty this defaults to "sAMAccountName". | *`uid`* __string__ | UID specifies the name of the attribute in the ActiveDirectory entry which whose value shall be used to uniquely identify the user within this ActiveDirectory provider after a successful authentication. Optional, when empty this defaults to "objectGUID". |=== diff --git a/generated/1.20/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go b/generated/1.20/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go index dc108466..791e47a6 100644 --- a/generated/1.20/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go +++ b/generated/1.20/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go @@ -46,7 +46,7 @@ type ActiveDirectoryIdentityProviderBind struct { } type ActiveDirectoryIdentityProviderUserSearchAttributes struct { - // Username specifies the name of the attribute in the ActiveDirectory entry whose value shall become the username + // Username specifies the name of the attribute in Active Directory entry whose value shall become the username // of the user after a successful authentication. This would typically be the same attribute name used in // Optional, when empty this defaults to "sAMAccountName". // +optional @@ -64,7 +64,7 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { // in the user's list of groups after a successful authentication. // The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory // server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". - // Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). + // Optional. When not specified, this defaults to "sAMAccountName". // +optional GroupName string `json:"groupName,omitempty"` } @@ -72,20 +72,17 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { type ActiveDirectoryIdentityProviderUserSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for users. // E.g. "ou=users,dc=example,dc=com". - // Optional, when not specified it will search the whole directory tree. - // Note that if your bind user only has permission to search a subtree, this must be specified. - // Search a subtree will also be faster. + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` - // Filter is the ActiveDirectory search filter which should be applied when searching for users. The pattern "{}" must occur + // Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur // in the filter at least once and will be dynamically replaced by the username for which the search is being run. - // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about ActiveDirectory filters, see + // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as the value from - // Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be - // explicitly specified, since the default value of "dn={}" would not work. + // Optional. When not specified, the default will be + // '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' // +optional Filter string `json:"filter,omitempty"` @@ -97,9 +94,8 @@ type ActiveDirectoryIdentityProviderUserSearch struct { type ActiveDirectoryIdentityProviderGroupSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. - // "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and - // authenticated users will not belong to any groups from the ActiveDirectory provider. Also, when not specified, - // the values of Filter and Attributes are ignored. + // "ou=groups,dc=example,dc=com". + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` @@ -109,7 +105,9 @@ type ActiveDirectoryIdentityProviderGroupSearch struct { // "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as "member={}". + // Optional. When not specified, the default will act as if the Filter were specified as + // "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + // This searches nested groups by default. // +optional Filter string `json:"filter,omitempty"` diff --git a/generated/1.20/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml b/generated/1.20/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml index 0f94c50a..48659053 100644 --- a/generated/1.20/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml +++ b/generated/1.20/crds/idp.supervisor.pinniped.dev_activedirectoryidentityproviders.yaml @@ -88,18 +88,15 @@ spec: and must match the case of the attribute name returned by the ActiveDirectory server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying - lower-case "dn". Optional. When not specified, the default - will act as if the GroupName were specified as "dn" (distinguished - name). + lower-case "dn". Optional. When not specified, this defaults + to "sAMAccountName". type: string type: object base: description: Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. "ou=groups,dc=example,dc=com". - When not specified, no group search will be performed and authenticated - users will not belong to any groups from the ActiveDirectory - provider. Also, when not specified, the values of Filter and - Attributes are ignored. + Optional, when not specified it will be based on the result + of a query for the default naming context. type: string filter: description: Filter is the ActiveDirectory search filter which @@ -111,7 +108,8 @@ spec: about ActiveDirectory filters, see https://ldap.com/ldap-filters. Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. Optional. When not specified, - the default will act as if the Filter were specified as "member={}". + the default will act as if the Filter were specified as "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + This searches nested groups by default. type: string type: object host: @@ -146,33 +144,28 @@ spec: type: string username: description: Username specifies the name of the attribute - in the ActiveDirectory entry whose value shall become the - username of the user after a successful authentication. - This would typically be the same attribute name used in - Optional, when empty this defaults to "sAMAccountName". + in Active Directory entry whose value shall become the username + of the user after a successful authentication. This would + typically be the same attribute name used in Optional, when + empty this defaults to "sAMAccountName". type: string type: object base: description: Base is the dn (distinguished name) that should be used as the search base when searching for users. E.g. "ou=users,dc=example,dc=com". - Optional, when not specified it will search the whole directory - tree. Note that if your bind user only has permission to search - a subtree, this must be specified. Search a subtree will also - be faster. + Optional, when not specified it will be based on the result + of a query for the default naming context. type: string filter: - description: Filter is the ActiveDirectory search filter which - should be applied when searching for users. The pattern "{}" - must occur in the filter at least once and will be dynamically - replaced by the username for which the search is being run. - E.g. "mail={}" or "&(objectClass=person)(uid={})". For more - information about ActiveDirectory filters, see https://ldap.com/ldap-filters. - Note that the dn (distinguished name) is not an attribute of - an entry, so "dn={}" cannot be used. Optional. When not specified, - the default will act as if the Filter were specified as the - value from Attributes.Username appended by "={}". When the Attributes.Username - is set to "dn" then the Filter must be explicitly specified, - since the default value of "dn={}" would not work. + description: Filter is the search filter which should be applied + when searching for users. The pattern "{}" must occur in the + filter at least once and will be dynamically replaced by the + username for which the search is being run. E.g. "mail={}" or + "&(objectClass=person)(uid={})". For more information about + LDAP filters, see https://ldap.com/ldap-filters. Note that the + dn (distinguished name) is not an attribute of an entry, so + "dn={}" cannot be used. Optional. When not specified, the default + will be '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' type: string type: object required: diff --git a/generated/latest/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go b/generated/latest/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go index dc108466..791e47a6 100644 --- a/generated/latest/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go +++ b/generated/latest/apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go @@ -46,7 +46,7 @@ type ActiveDirectoryIdentityProviderBind struct { } type ActiveDirectoryIdentityProviderUserSearchAttributes struct { - // Username specifies the name of the attribute in the ActiveDirectory entry whose value shall become the username + // Username specifies the name of the attribute in Active Directory entry whose value shall become the username // of the user after a successful authentication. This would typically be the same attribute name used in // Optional, when empty this defaults to "sAMAccountName". // +optional @@ -64,7 +64,7 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { // in the user's list of groups after a successful authentication. // The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory // server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". - // Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). + // Optional. When not specified, this defaults to "sAMAccountName". // +optional GroupName string `json:"groupName,omitempty"` } @@ -72,20 +72,17 @@ type ActiveDirectoryIdentityProviderGroupSearchAttributes struct { type ActiveDirectoryIdentityProviderUserSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for users. // E.g. "ou=users,dc=example,dc=com". - // Optional, when not specified it will search the whole directory tree. - // Note that if your bind user only has permission to search a subtree, this must be specified. - // Search a subtree will also be faster. + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` - // Filter is the ActiveDirectory search filter which should be applied when searching for users. The pattern "{}" must occur + // Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur // in the filter at least once and will be dynamically replaced by the username for which the search is being run. - // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about ActiveDirectory filters, see + // E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as the value from - // Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be - // explicitly specified, since the default value of "dn={}" would not work. + // Optional. When not specified, the default will be + // '(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(|(sAMAccountName={}")(mail={}))(sAMAccountType=805306368))' // +optional Filter string `json:"filter,omitempty"` @@ -97,9 +94,8 @@ type ActiveDirectoryIdentityProviderUserSearch struct { type ActiveDirectoryIdentityProviderGroupSearch struct { // Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. - // "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and - // authenticated users will not belong to any groups from the ActiveDirectory provider. Also, when not specified, - // the values of Filter and Attributes are ignored. + // "ou=groups,dc=example,dc=com". + // Optional, when not specified it will be based on the result of a query for the default naming context. // +optional Base string `json:"base,omitempty"` @@ -109,7 +105,9 @@ type ActiveDirectoryIdentityProviderGroupSearch struct { // "&(objectClass=groupOfNames)(member={})". For more information about ActiveDirectory filters, see // https://ldap.com/ldap-filters. // Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. - // Optional. When not specified, the default will act as if the Filter were specified as "member={}". + // Optional. When not specified, the default will act as if the Filter were specified as + // "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". + // This searches nested groups by default. // +optional Filter string `json:"filter,omitempty"` diff --git a/go.mod b/go.mod index 7c91fc2e..584c25a5 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,6 @@ require ( github.com/go-logr/stdr v0.4.0 github.com/go-openapi/spec v0.20.3 // indirect github.com/gofrs/flock v0.8.1 - github.com/gofrs/uuid v3.2.0+incompatible github.com/golang/mock v1.6.0 github.com/google/go-cmp v0.5.6 github.com/google/gofuzz v1.2.0 diff --git a/go.sum b/go.sum index fce7b442..6c545de3 100644 --- a/go.sum +++ b/go.sum @@ -554,7 +554,6 @@ github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5x github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw= github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU= github.com/gofrs/uuid v3.1.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM= -github.com/gofrs/uuid v3.2.0+incompatible h1:y12jRkkFxsd7GpqdSZ+/KCs/fJbqpEXSGd4+jfEaewE= github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM= github.com/gofrs/uuid/v3 v3.1.2/go.mod h1:xPwMqoocQ1L5G6pXX5BcE7N5jlzn2o19oqAKxwZW/kI= github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=